PT-2023-24650 · Spring · Spring Hateoas

Hans Hosea Schaefer · Published 2023-07-17 · Updated 2023-07-17 · CVE-2023-34036

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Spring HATEOAS (affected versions not specified)

Description Reactive web applications using Spring HATEOAS to produce hypermedia-based responses may be exposed to malicious forwarded headers if not behind a trusted proxy or without measures to handle such headers in WebFlux or the underlying HTTP server. The application is affected if it uses the reactive web stack with Spring HATEOAS and does not guard against clients submitting (X-)Forwarded headers.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-644

CWE-116

Related Identifiers

CVE-2023-34036

GHSA-7M5C-FGWF-MWPH

Affected Products

Spring Hateoas

References · 7

• https://osv.dev/vulnerability/CVE-2023-34036 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7m5c-fgwf-mwph · Vendor Advisory
• https://spring.io/security/cve-2023-34036 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34036 · Security Note
• https://github.com/spring-projects/spring-hateoas · Note
• https://t.me/cvenotify/54475 · Telegram Post
• https://t.me/cibsecurity/66807 · Telegram Post